Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-3600

Summary
Assigner-ProgressSoftware
Assigner Org ID-f9fea0b6-671e-4eea-8fde-31911902ae05
Published At-14 May, 2025 | 13:21
Updated At-27 Aug, 2025 | 14:54
Rejected At-
Credits

Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:ProgressSoftware
Assigner Org ID:f9fea0b6-671e-4eea-8fde-31911902ae05
Published At:14 May, 2025 | 13:21
Updated At:27 Aug, 2025 | 14:54
Rejected At:
▼CVE Numbering Authority (CNA)
Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.

Affected Products
Vendor
Progress Software CorporationProgress Software
Product
Telerik UI for ASP.NET AJAX
Default Status
unaffected
Versions
Affected
  • From 2011.2.712 before 2025.1.416 (custom)
Problem Types
TypeCWE IDDescription
N/AN/AUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Type: N/A
CWE ID: N/A
Description: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-138CAPEC-138: Reflection Injection
CAPEC ID: CAPEC-138
Description: CAPEC-138: Reflection Injection
Solutions

Configurations

Workarounds

Exploits

Credits

finder
Piotr Bazydlo (@chudyPB) of watchTowr
Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600
vendor-advisory
Hyperlink: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-470CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Type: CWE
CWE ID: CWE-470
Description: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@progress.com
Published At:14 May, 2025 | 14:15
Updated At:27 Aug, 2025 | 15:15

In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE Matches

Progress Software Corporation
progress
>>telerik_ui_for_asp.net_ajax>>Versions from 2011.2712(inclusive) to 2025.1.218(inclusive)
cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-470Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-470
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600security@progress.com
Mitigation
Vendor Advisory
Hyperlink: https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600
Source: security@progress.com
Resource:
Mitigation
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

9Records found

CVE-2023-40052
Matching Score-8
Assigner-Progress Software Corporation
ShareView Details
Matching Score-8
Assigner-Progress Software Corporation
CVSS Score-7.5||HIGH
EPSS-0.03% / 6.87%
||
7 Day CHG~0.00%
Published-18 Jan, 2024 | 15:11
Updated-29 Aug, 2024 | 19:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Progress Application Server (PAS) for OpenEdge Denial of Service

This issue affects Progress Application Server (PAS) for OpenEdge in versions 11.7 prior to 11.7.18, 12.2 prior to 12.2.13, and innovation releases prior to 12.8.0 .  An attacker who can produce a malformed web request may cause the crash of a PASOE agent potentially disrupting the thread activities of many web application clients. Multiple of these DoS attacks could lead to the flooding of invalid requests as compared to the server’s remaining ability to process valid requests.

Action-Not Available
Vendor-Progress Software Corporation
Product-openedge_innovationopenedgeOpenEdgeopenedge_innovationopenedge
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2023-36933
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-15.68% / 94.45%
||
7 Day CHG~0.00%
Published-05 Jul, 2023 | 00:00
Updated-21 Nov, 2024 | 14:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.

Action-Not Available
Vendor-n/aProgress Software Corporation
Product-moveit_transfern/a
CWE ID-CWE-755
Improper Handling of Exceptional Conditions
CVE-2024-5013
Matching Score-8
Assigner-Progress Software Corporation
ShareView Details
Matching Score-8
Assigner-Progress Software Corporation
CVSS Score-7.5||HIGH
EPSS-1.08% / 76.99%
||
7 Day CHG~0.00%
Published-25 Jun, 2024 | 20:11
Updated-21 Aug, 2024 | 13:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WhatsUp Gold InstallController Denial-of-Service Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible.

Action-Not Available
Vendor-Progress Software Corporation
Product-whatsup_goldWhatsUp Goldwhatsup_gold
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2024-5011
Matching Score-8
Assigner-Progress Software Corporation
ShareView Details
Matching Score-8
Assigner-Progress Software Corporation
CVSS Score-7.5||HIGH
EPSS-7.22% / 91.24%
||
7 Day CHG~0.00%
Published-25 Jun, 2024 | 20:01
Updated-13 Feb, 2025 | 17:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WhatsUp Gold TestController Chart denial of service vulnerability

In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. A specially crafted unauthenticated HTTP request to the TestController Chart functionality can lead to denial of service.

Action-Not Available
Vendor-Progress Software Corporation
Product-whatsup_goldWhatsUp Goldwhatsup_gold
CWE ID-CWE-400
Uncontrolled Resource Consumption
CVE-2024-8014
Matching Score-6
Assigner-Progress Software Corporation
ShareView Details
Matching Score-6
Assigner-Progress Software Corporation
CVSS Score-8.8||HIGH
EPSS-1.41% / 79.69%
||
7 Day CHG-0.13%
Published-09 Oct, 2024 | 14:16
Updated-15 Oct, 2024 | 14:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Telerik Reporting EntityDataSource Insecure Type Resolution

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.

Action-Not Available
Vendor-Progress Software Corporation
Product-telerik_reportingTelerik Reportingtelerik_reporting
CWE ID-CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2024-8048
Matching Score-6
Assigner-Progress Software Corporation
ShareView Details
Matching Score-6
Assigner-Progress Software Corporation
CVSS Score-7.8||HIGH
EPSS-0.08% / 23.78%
||
7 Day CHG-0.00%
Published-09 Oct, 2024 | 14:18
Updated-15 Oct, 2024 | 14:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Telerik Reporting Insecure Expression Evaluation

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.

Action-Not Available
Vendor-Progress Software Corporation
Product-telerik_reportingTelerik Reportingtelerik_reporting
CWE ID-CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2024-8015
Matching Score-6
Assigner-Progress Software Corporation
ShareView Details
Matching Score-6
Assigner-Progress Software Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.40% / 60.15%
||
7 Day CHG-0.12%
Published-09 Oct, 2024 | 14:49
Updated-15 Oct, 2024 | 14:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Telerik Report Server Insecure Type Resolution

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

Action-Not Available
Vendor-Progress Software Corporation
Product-telerik_report_serverTelerik Reportingtelerik_reporting
CWE ID-CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2024-6096
Matching Score-6
Assigner-Progress Software Corporation
ShareView Details
Matching Score-6
Assigner-Progress Software Corporation
CVSS Score-8.8||HIGH
EPSS-1.42% / 79.78%
||
7 Day CHG~0.00%
Published-24 Jul, 2024 | 14:00
Updated-25 Apr, 2025 | 23:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Unsafe Deserialization Vulnerability

In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.

Action-Not Available
Vendor-Progress Software Corporation
Product-telerik_reportingTelerik Reportingtelerik_reporting
CWE ID-CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CVE-2025-2794
Matching Score-4
Assigner-VulnCheck
ShareView Details
Matching Score-4
Assigner-VulnCheck
CVSS Score-7.5||HIGH
EPSS-0.12% / 32.13%
||
7 Day CHG+0.01%
Published-31 Mar, 2025 | 16:22
Updated-01 Apr, 2025 | 20:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Kentico Xperience Staging Unsafe Reflection Kentico Xperience

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.

Action-Not Available
Vendor-Kentico Software
Product-Xperience
CWE ID-CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Details not found